Parent

Class/Module Index [+]

Quicksearch

Rex::Post::Meterpreter::Ui::Console::CommandDispatcher::Sniffer

Packet sniffer extension user interface.

Constants

Klass

Public Class Methods

new(shell) click to toggle source

Initializes an instance of the sniffer command interaction.

# File lib/rex/post/meterpreter/ui/console/command_dispatcher/sniffer.rb, line 22
def initialize(shell)
        super
end

Public Instance Methods

cmd_sniffer_dump(*args) click to toggle source
# File lib/rex/post/meterpreter/ui/console/command_dispatcher/sniffer.rb, line 116
def cmd_sniffer_dump(*args)
        intf = args[0].to_i
        if (intf == 0 or not args[1])
                print_error("Usage: sniffer_dump [interface-id] [pcap-file]")
                return
        end

        path_cap = args[1]
        path_raw = args[1] + '.raw'

        fd = ::File.new(path_raw, 'wb+')

        print_status("Flushing packet capture buffer for interface #{intf}...")
        res = client.sniffer.capture_dump(intf)
        print_status("Flushed #{res[:packets]} packets (#{res[:bytes]} bytes)")

        bytes_all = res[:bytes] || 0
        bytes_got = 0
        bytes_pct = 0
        linktype = res[:linktype]
        while (bytes_all > 0)
                res = client.sniffer.capture_dump_read(intf,1024*512)

                bytes_got += res[:bytes]

                pct = ((bytes_got.to_f / bytes_all.to_f) * 100).to_i
                if(pct > bytes_pct)
                        print_status("Downloaded #{"%.3d" % pct}% (#{bytes_got}/#{bytes_all})...")
                        bytes_pct = pct
                end
                break if res[:bytes] == 0
                fd.write(res[:data])
        end

        fd.close

        print_status("Download completed, converting to PCAP...")

        fd = nil
        if(::File.exist?(path_cap))
                fd = ::File.new(path_cap, 'ab+')
        else
                fd = ::File.new(path_cap, 'wb+')
                fd.write([0xa1b2c3d4, 2, 4, 0, 0, 65536, linktype].pack('NnnNNNN'))
        end

        pkts = {}
        od = ::File.new(path_raw, 'rb')


        # TODO: reorder packets based on the ID (only an issue if the buffer wraps)
        while(true)
                buf = od.read(20)
                break if not buf

                idh,idl,thi,tlo,len = buf.unpack('N5')
                break if not len
                if(len > 10000)
                        print_error("Corrupted packet data (length:#{len})")
                        break
                end

                pkt_id = (idh << 32) +idl
                pkt_ts = Rex::Proto::SMB::Utils.time_smb_to_unix(thi,tlo)
                pkt    = od.read(len)

                fd.write([pkt_ts,0,len,len].pack('NNNN')+pkt)
        end
        od.close
        fd.close

        ::File.unlink(path_raw)
        print_status("PCAP file written to #{path_cap}")
end
cmd_sniffer_interfaces(*args) click to toggle source
# File lib/rex/post/meterpreter/ui/console/command_dispatcher/sniffer.rb, line 41
def cmd_sniffer_interfaces(*args)

        ifaces = client.sniffer.interfaces()

        print_line()

        ifaces.each do |i|
                print_line(sprintf("%d - '%s' ( type:%d mtu:%d usable:%s dhcp:%s wifi:%s )",
                        i['idx'], i['description'],
                        i['type'], i['mtu'], i['usable'], i['dhcp'], i['wireless'])
                )
        end

        print_line()

        return true
end
cmd_sniffer_release(*args) click to toggle source
# File lib/rex/post/meterpreter/ui/console/command_dispatcher/sniffer.rb, line 103
def cmd_sniffer_release(*args)
        intf = args[0].to_i
        if (intf == 0)
                print_error("Usage: sniffer_release [interface-id]")
                return
        end

        res = client.sniffer.capture_release(intf)
        print_status("Flushed #{res[:packets]} packets (#{res[:bytes]} bytes) from interface #{intf}")

        return true
end
cmd_sniffer_start(*args) click to toggle source
# File lib/rex/post/meterpreter/ui/console/command_dispatcher/sniffer.rb, line 59
def cmd_sniffer_start(*args)
        intf = args.shift.to_i
        if (intf == 0)
                print_error("Usage: sniffer_start [interface-id] [packet-buffer (1-200000)] [bpf filter (posix meterpreter only)]")
                return
        end
        maxp = (args.shift || 50000).to_i
        bpf  = args.join(" ")

        client.sniffer.capture_start(intf, maxp, bpf)
        print_status("Capture started on interface #{intf} (#{maxp} packet buffer)")
        return true
end
cmd_sniffer_stats(*args) click to toggle source
# File lib/rex/post/meterpreter/ui/console/command_dispatcher/sniffer.rb, line 87
def cmd_sniffer_stats(*args)
        intf = args[0].to_i
        if (intf == 0)
                print_error("Usage: sniffer_stats [interface-id]")
                return
        end

        stats = client.sniffer.capture_stats(intf)
        print_status("Capture statistics for interface #{intf}")
        stats.each_key do |k|
                print_line("\t#{k}: #{stats[k]}")
        end

        return true
end
cmd_sniffer_stop(*args) click to toggle source
# File lib/rex/post/meterpreter/ui/console/command_dispatcher/sniffer.rb, line 73
def cmd_sniffer_stop(*args)
        intf = args[0].to_i
        if (intf == 0)
                print_error("Usage: sniffer_stop [interface-id]")
                return
        end

        res = client.sniffer.capture_stop(intf)
        print_status("Capture stopped on interface #{intf}")
        print_status("There are #{res[:packets]} packets (#{res[:bytes]} bytes) remaining")
        print_status("Download or release them using 'sniffer_dump' or 'sniffer_release'")
        return true
end
commands() click to toggle source

List of supported commands.

# File lib/rex/post/meterpreter/ui/console/command_dispatcher/sniffer.rb, line 29
def commands
        {
                "sniffer_interfaces" => "Enumerate all sniffable network interfaces",
                "sniffer_start" => "Start packet capture on a specific interface",
                "sniffer_stop"  => "Stop packet capture on a specific interface",
                "sniffer_stats" => "View statistics of an active capture",
                "sniffer_dump"  => "Retrieve captured packet data to PCAP file",
                "sniffer_release" => "Free captured packets on a specific interface instead of downloading them",
        }
end
name() click to toggle source

Name for this dispatcher sni

# File lib/rex/post/meterpreter/ui/console/command_dispatcher/sniffer.rb, line 194
def name
        "Sniffer"
end

[Validate]

Generated with the Darkfish Rdoc Generator 2.